Fabrikam Inc. has enabled Microsoft 365 Copilot and discovered that Copilot is surfacing confidential HR documents to general employees in its responses. The security administrator suspects data oversharing is occurring through SharePoint. What is the BEST approach to identify and resolve this data readiness issue?
Select an answer to reveal the explanation.
Short Explanation
Copilot only surfaces what users already have permission to see, so if it's showing HR docs to everyone, the permissions are too open. You need to find that overshared content and lock it down. Use Microsoft Purview DSPM for AI to identify it and apply sensitivity labels.
Full Explanation
Microsoft Purview Data Security Posture Management (DSPM) for AI is specifically designed to address data readiness issues that arise with Copilot, including oversharing of sensitive content. DSPM for AI scans your Microsoft 365 environment to identify content that is accessible to broad audiences — such as files shared with 'Everyone' or 'All Users' in SharePoint — and provides recommendations to apply sensitivity labels, restrict permissions, and resolve compliance gaps. Sensitivity labels, once applied, can enforce encryption and restrict who can open documents regardless of where they are stored. The approach of disabling Microsoft 365 Copilot for all users until SharePoint permissions are audited manually is a disruptive stopgap that does not solve the underlying permission problem. The data remains overshared even with Copilot turned off, meaning users could still access those documents directly. The approach of configuring Conditional Access policies in Microsoft Entra to block Copilot access during business hours controls when and how users authenticate to services. It is not designed to remediate SharePoint permission issues or prevent Copilot from surfacing overshared documents. The approach of enabling Communication compliance policies in Microsoft Purview to monitor Copilot outputs monitors Copilot interactions for policy violations such as inappropriate language. While useful for governance, it does not identify or resolve oversharing at the data layer. Exam tip: When a question involves Copilot surfacing data it should not, the answer usually involves Microsoft Purview — specifically DSPM for AI for oversharing discovery, or sensitivity labels for access control. Copilot respects Microsoft 365 permissions, so fixing permissions is the root-cause fix.